iMessage 'denial-of-service' attack crashes devs' iOS Messages apps

A recent spate of prank texts sent to a group of iOS developers has revealed a limitation in how Apple handles data sent through its iMessage service, which in some cases can crash the app if the incoming message is too long or contains overly complex characters.

Source: The Next Web

As reported to The Next Web, iOS app developers iH8sn0w, well known for his jailbreak tool, and Grant Paul were among those targeted by a type of denial of service (DoS) attack that overwhelmed their respective Messages inboxes with a load of automatically-generated transmissions.

The two devs believe the messages to have been sent one after another from the Messages app on OS X, with a simple AppleScript effecting the barrage that prompts a victim to constantly clear notifications and text.

Whats happening is a simple flood: Apple doesnt seem to limit how fast messages can be sent, so the attacker is able to send thousands of messages very quickly, Paul said.

iH8sn0w mocked up a proof-of-concept AppleScript to demonstrate how such an attack may work. If Apple doesn't limit the influx of messages, a user's app will quickly become filled with what amounts to piles of spam.

As vexing as a continuous string of nonsense can be, a real issue arises when extraordinarily long or complex messages are received. This can cause Messages on iOS to crash because it can't process and display the massive amount of data correctly. According to the developers, the app will force itself to close and won't be able to re-open because it can't properly render the text.

While no surefire solution has been found to remedy a crashed Messages app, the publication suggests "playing around with sending a regular message, then locking the phone and activating the message notification until youre able to time it right to delete the message thread thats causing the problem." Paul effectively employed this method to delete the offending text and regain control of the app.

It should be noted that if an attacker gets ahold of a user's iMessage handle, the only option may be to disable that account temporarily. If a user's phone number is compromised, iMessage itself might have to be turned off.

The attacker's identity is unknown at this time, but the messages appear to have originated from a Twitter account used to sell UDIDs and provisioning profiles. Disposable email accounts were being used to send the spam, making it difficult to simply block the culprit as they can simply open another and continue the assault.

There could be a limit like .1 seconds, and then a per-minute limit that no legitimate sender would ever exceed. Doesn't mean we'll be forced to wait.

P.S. Finally, some spam in the proper original (computing) sense of the word! It didn't start out meaning "junk mail," or "ads," it meant overloading someone's inbox--cramming it like spam in a can. But the term got away from its denial-of-service meaning somehow. Which doesn't make sense: what does spam in a can have to do with ads or unwanted messages per se? (At least the original meaning has been retained in multiplayer gaming: there, spamming still isn't about unwanted contacts, but about overload.)

There could be a limit like .1 seconds, and then a per-minute limit that no legitimate sender would ever exceed. Doesn't mean we'll be forced to wait.

P.S. Finally, some spam in the proper original (computing) sense of the word! It didn't start out meaning "junk mail," or "ads," it meant overloading someone's inbox--cramming it like spam in a can. But the term got away from its denial-of-service meaning somehow. Which doesn't make sense: what does spam in a can have to do with ads or unwanted messages per se? (At least the original meaning has been retained in multiplayer gaming: there, spamming still isn't about unwanted contacts, but about overload.)

And that's not the biggest problem with iMessage. The biggest problem is that you can't block people from sending you iMessages. A girl I know kept receiving harassing iMessages from her ex-boyfriend for months. No way to block his incoming iMessages.

- have a blacklist to block unwanted iMessage users
- limit the number of consecutive messages
- limit message size to 2000 characters or something

It doesn't have to limit reply time at all. It can just limit consecutive messages from the sender to e.g 5 within 5 minutes. This stops harassment. If both users are sending, there is no need to limit anything.

- have a blacklist to block unwanted iMessage users
- limit the number of consecutive messages
- limit message size to 2000 characters or something

It doesn't have to limit reply time at all. It can just limit consecutive messages from the sender to e.g 5 within 5 minutes. This stops harassment. If both users are sending, there is no need to limit anything.

5 within 5 minutes is not enough for normal people to have a conversation...Even if you mean without a response. stopping anything over 5 every 5 seconds might help.

5 within 5 minutes is not enough for normal people to have a conversation...Even if you mean without a response. stopping anything over 5 every 5 seconds might help.

Who sends more than 5 messages without getting a reply? A pain in the ass that's who. Maybe in a situation like if someone is feeding sports results but it still doesn't need to be all that frequent. They can put more info into each message.

It could even just have a prompt if it detects a high frequency of messages.

"iMessage has detected a large number of incoming messages from the recipient. Block User or Allow?" Block User can just put a lock icon on their side of the iMessage window in every conversation they are in and if you wanted to unblock them, you'd just tap it and confirm the unblock.

That way a reply wouldn't be necessary but incoming messages would be put on hold until the recipient allowed the conversation to continue. This would have to be done every time it detected a lot of consecutive incoming messages so there's never a chance of it flooding. It can be a little more than 5 if necessary. Apple will have all the iMessage data and should be able to check what the maximum number of replies are that people typically make in a given time without getting a reply and set the appropriate limits.

Someone might forget they blocked a user so there can perhaps be a push notification after a day to ask if it should be permanent.

GREAT, now an update will probably change that for all instances instead of just stopping things like this. I like not being forced to wait to send messages.

Any needed updates would be server side. Catch and delay an fast streams, perhaps even determine if they are dupes and block them. Maybe even disable, after a manual review determines someone is either spamming tons of folks or trying to bork up one party, disable said ID from iMessages possibly at the ID, IP and/or device ID level.

Originally Posted by Marvin
Who sends more than 5 messages without getting a reply? A pain in the ass that's who. Maybe in a situation like if someone is feeding sports results but it still doesn't need to be all that frequent. They can put more info into each message.

I'd ask if you're joking, but I know you too well. What I think you might not know very well is kids these days. Five messages a minute will utterly destroy iMessage adoption. We're talking complete decimation.

Originally Posted by charlituna
Any needed updates would be server side.